Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Blur Integration #371

Open
wants to merge 42 commits into
base: main
Choose a base branch
from
Open

Blur Integration #371

wants to merge 42 commits into from

Conversation

zhoujia6139
Copy link
Contributor

Security Checklist

  • 1. Re-Entrancy
  • 2. Arithmetic Over/Under Flows
  • 3. Unexpected Ether
  • 4. Delegatecall
  • 5. Default Visibilities
  • 6. Entropy Illusion
  • 7. External Contract Referencing
  • 8. Short Address/Parameter Attack (off chain)
  • 9. Unchecked CALL Return Values
  • 10. Race Conditions / Front Running
  • 11. Denial Of Service (DOS)
  • 12. Block Timestamp Manipulation
  • 13. Constructors with Care
  • 14. Uninitialized Storage Pointers
  • 15. Floating Points and Precision
  • 16. Tx.Origin Authentication
  • 17. Address.isContract Re-Entrancy via Constructor

⚠️ NOTES ⚠️

Make sure to think about each of these exploits in this PR.

@zhoujia6139 zhoujia6139 requested a review from a team as a code owner April 15, 2023 03:56
@zhoujia6139 zhoujia6139 marked this pull request as draft April 15, 2023 03:57
@zhoujia6139 zhoujia6139 marked this pull request as ready for review April 17, 2023 13:33
@@ -361,4 +380,53 @@ contract PoolParameters is
);
userConfig.auctionValidityTime = block.timestamp;
}

/// @inheritdoc IPoolParameters
function enableBlurExchange() external onlyPoolAdmin {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suggest using different names for these. as we are not really enabling the actual exchange

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

enableBlurIntegration?

request.borrowAmount,
timeLockParams
);
IWETH(weth).withdraw(request.borrowAmount);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can't we transfer weth directly? might save us one transfer

// currency token. address(0) means ETH
address paymentToken;
// cash amount from user wallet
uint256 listingPrice;

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is cash amount ? or listing price?

Errors.INVALID_REQUEST_STATUS
);

address keeper = ps._blurExchangeKeeper;

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could we not to check “msg.sender == keeper” to save some gas.

address nTokenAddress = nftReserve.xTokenAddress;
// no time lock needed here
DataTypes.TimeLockParams memory timeLockParams;
(, uint64 collateralizedBalance) = INToken(nTokenAddress).burn(

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if the nToken is in auction , will revert.

.getParams();
// ensure user can't borrow/withdraw with the new mint nToken
require(
request.listingPrice >= floorPrice.percentMul(liquidationThreshold),

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. user init buy from blur which have high boost token id (set require.listingprice = nToken floor price * LS)
  2. user get more borrow limit : nToken floor price * boost *LTV - nToken floor price * LS
  3. user can borrow more money.


//mint debt token
if (totalBorrow > 0) {
BorrowLogic.executeBorrow(

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we do transferUnderlyingTo before executeBorrow ? since the borrow use rate is not correct in updateInterestRates now.
borrow use rate = total debt / (balance (pToken contract) + total debt)
balance (pToken contract) should subtract the totalBorrow

request.tokenId
);

return request.listingPrice + requestFee - request.borrowAmount;

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we save some gas if calculate needCashETH first and sent into validateInitiateBlurExchangeRequest ?

* chore: basic implementation for BLUR sell

* chore: fix typo

* chore: check ape pair staking and gas optimization

* chore: check owner and fix interest rate issue

* chore: keeper fulfill request with ETH

* chore: fix updating wrong status

* chore: forbid initiate request for uniswapV3 and stakeFish
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants